CVE-2021-22911 PoC — Rocket.Chat 安全漏洞

Source

https://github.com/optionalCTF/Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911

Associated Vulnerability

Title: Rocket.Chat 安全漏洞 (CVE-2021-22911)
Description:A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Description

Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911

Readme

# Rocket.Chat Automated Unauthenticated Account Takeover to RCE (CVE-2021-22911)
Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911

The original PoC created by Enox.


Currently this only works for accounts without 2FA. I will be adding 2FA bypasses shortly
---
### Created by optional
- [optional's Twitter](https://twitter.com/optionalctf)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →